Rulez_Recon

1)  Take an IP address  and reverse lookup it's domain name
2)  Take that domain name and enumerate all subdomains (bruteforce or by other means)
3)  Make sure any  false-positive  subdomains are filtered out
4)  output the list of subdomains to a  CSV file





basically... we're looking for:

HTTP-Basic-Auth
HTTP-Forms
URL  extensions:  pl, asp, aspx,jsp,jspx,php,cgi